Critical Command Injection in BerriAI LiteLLM (CVE‑2026‑42271) & Authentication Flaw in Check Point Security Gateway (CVE‑2026‑50751) Added to CISA KEV Catalog
What It Is – CISA has officially added two actively‑exploited CVEs to its Known Exploited Vulnerabilities (KEV) catalog: a command‑injection flaw in BerriAI’s LiteLLM AI service (CVE‑2026‑42271) and an improper‑authentication issue in Check Point Security Gateway (CVE‑2026‑50751). Both weaknesses allow unauthenticated attackers to execute arbitrary commands or bypass login controls, respectively.
Exploitability – Both CVEs are confirmed to be exploited in the wild, with public proof‑of‑concept code circulating for the LiteLLM injection and multiple threat‑intel reports of credential‑stealing campaigns targeting Check Point gateways. The CVSS scores are 9.8 (Critical) for CVE‑2026‑42271 and 8.6 (High) for CVE‑2026‑50751.
Affected Products –
- BerriAI LiteLLM – AI‑generated text service used by SaaS platforms, internal tooling, and research labs.
- Check Point Security Gateway – Network security appliance deployed across enterprise, data‑center, and cloud environments.
TPRM Impact – These vulnerabilities represent a direct supply‑chain risk: any third‑party that integrates BerriAI’s LLM APIs or relies on Check Point firewalls inherits the exposure. Compromise could lead to data exfiltration, lateral movement, or service disruption across downstream customers.
Recommended Actions –
- Prioritize remediation – Apply vendor‑released patches or mitigations immediately; treat as “high‑severity” in your vulnerability‑management backlog.
- Validate inventory – Confirm whether any of your critical vendors or internal services consume BerriAI LiteLLM or run Check Point gateways.
- Segmentation & monitoring – Isolate affected assets, enable strict outbound traffic filtering, and increase logging for anomalous command execution or authentication failures.
- Contractual review – Update third‑party risk clauses to require timely patching of KEV‑listed vulnerabilities.
- Report status – Document remediation progress for internal governance and, where applicable, for compliance with BOD 22‑01.
Source: CISA Advisory – June 8 2026